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Abstract 


The traditional FOO e-voting protocols adopt centralized and non-transparent count center, which leads to distrust to the center 
and doubts the fairness and correctness of the vote. However, blockchain is the most innovative technology in the current 
era and promises to solve the trust problem in the system with one center. In this paper, an improved FOO e-voting protocol 
is proposed using blockchain, which tries to address the limitation or weakness in existing systems. The traditional trusted 
third party is replaced by smart contract; specifically, our scheme is deployed using hyperledger fabric. The implementation 
is enforced by the consensus mechanism, which ensures the security of the blockchain. Through the analysis, the proposed 
scheme is proved to satisfy the necessary requirements for an e-voting protocol; meantime the trust assumption is reduced 
significantly. Therefore, the proposed protocol is more versatile and practical. 


Keywords Blockchain - E-voting - Hyperledger and Blind signature 


1 Introduction 


E-voting, a new online voting system, has been widely 
researched in the past years. Compared with traditional vot- 
ing system, e-voting scheme saves a lot of economic costs 
in collecting ballots and counting results. It must satisfy 
the requirements of legitimacy, anonymity [1,2], integrity, 
unforgeability, non-repeatability and non-tampering. To add- 
ress these concerns, a large number of voting literature have 
been proposed over the past 30 years, including the electronic 


voting scheme without receipting at no polling stations [3], 
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the “end-to-end” verifiable internet protocol [4], voting pro- 
tocols for mobile ad hoc networks [5], lightweight remote 
voting protocols based on hash functions [6], and internet 
voting protocols against bribery attacks [7,8]. 

In 1981, the first e-voting protocol was proposed by 
Chaum [9], which uses digital pseudonym to hide the identity 
of the voter and tally the ballots through anonymous mes- 
sage. In 1985, Cohen and Fischer [10] proposed a secure 
secret ballot electronic voting scheme and completed the 
voting process based on homomorphic encryption. With 
the development of cryptography, the cryptographic tech- 
niques employed in anonymous electronic voting protocols 
are divided into three categories, namely blind signature [11], 
ring signature [12], and proxy signature [13]. Generally, e- 
voting employs a trusted third party (TTP) to collect ballots 
from voters for counting. 

Fujioka, Okamoto and Ohta (FOO) [14] proposed a prac- 
tical e-voting protocol with TTP using bit commitment and 
blind signature to ensure the privacy of voter and the fair- 
ness of tally. Then, a large number of e-voting softwares 
have been developed and applied, such as EVOX [15] and 
SENSUS [16]. However, FOO e-voting scheme also has 
weakness. For example: (1) Low voting efficiency. (2) The 
problem that the counting result can be tampered and can- 
not be found out once the voter abstains from voting. (3) 
Cheating problem in the counting phase. Therefore, in order 
to solve the above problems, many scholars have proposed 
different e-voting protocols based on FOO voting scheme. 
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Ohkubo et al. [17] improved FOO e-voting scheme based 
on threshold encryption and the Mix-Net communication 
channel. However, for the voters, they cannot take part in 
the counting and they can leave after voting in [17]. Chen 
et al. [18] proposed an electronic voting protocol based on 
semi-trust mode. However, its communication burden is so 
high that it is difficult to put into practical application. To 
improve the efficiency, Tao et al. [19] proposed a more conve- 
nient and efficient voting protocol. Compared with complex 
cryptographic techniques, they employ the blind signature 
technique and the dynamic ballots to preserve privacy in [19]. 
Then, Darwish et al. [20] proposed a new cryptographic vot- 
ing verifiable system using public key infrastructure (PKI) 
and blind digital signature, which is more efficient. How- 
ever, these schemes all rely on a TTP, and voters must trust 
the central authority. In this case, users cannot resist the col- 
lusion attack of the counting center and the management 
center. 

Recently, blockchain with the growing popularity in 
bitcoin provides a new way to improve FOO e-voting sys- 
tems. In a blockchain-based system, no trusted computing 
center is necessary; instead, each miner in blockchain sys- 
tem stores blocks locally. Without TTP, the blockchain 
guarantees the decentralization and non-tampering and can 
be regarded as a conceptual third party. Therefore, the 
previous TTP can be replaced by the smart contract of 
blockchain to resist colluding attack. In addition, blockchain- 
based FOO e-voting systems satisfy the necessary security 
requirements and enhance the versatility and practicabil- 
ity. 

The motivation for our work stems from the reasonable 
assumptions in [19]. Assume that the TTP is credible in [21], 
but the credibility of the TTP is downgraded as more and 
more voters trust the electoral structure and make conces- 
sions. Besides, privacy is important in the voting and counting 
phase, since the ballot is voter’s vote certificate, both leak and 
tamper can cause security problem. Therefore, our focus is 
to enhance privacy and reduce the confidence assumption in 
the counting center. 

Our contribution First, we summarize the existing impro- 
ved FOO voting protocols. Second, we use smart contracts 
to replace TTP and at the same time guarantee the properties 
of traditional FOO voting protocols, namely the anonymity, 
verifiability, and receipt freeness. Since TTP is replaced 
by smart contracts, the trust assumption is significantly 
reduced. 

The rest of the paper is organized as follows. In Sect. 2, 
the necessary cryptographic preliminaries are introduced. 
In Sect. 3, the communication model and design goals 
are presented. FOO voting scheme is reviewed and ana- 
lyzed in Sect. 4. Our scheme is presented and analyzed 
in Sects. 5 and 6. Finally, this paper is concluded in 
Sect. 7. 
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2 Preliminaries 


The following cryptographic concepts and definitions are 
introduced in this section. 


2.1 Blind signature 


The blind signature scheme has been presented by Chaum 
[22], which is widely used to achieve the anonymity. At 
present, many blind signature protocols have been proposed, 
and they usually have two security characteristics: blind- 
ness and unforgeability [23—25]. The security requirements 
for blind signatures have been formalized by Juels [24] and 
Stern [26]. The blind signature usually consists of following 
phases: 

Initialization phase All the system parameters of both 
requester and signer are initialized in this phase. Let (e, n) 
be the signer’s public key and d his private key. 

Blinding phase A requester chooses a random number r as 
blinding factor to blind a message and gets the information 
after blindness, B’ 


B'=r°Bmodn (1) 


Signing phase After receiving the blinded message B’, the 
signer uses its privacy key d to sign it and obtains the blind 
signature, S’: 


S’ = (B)! = rB? modn (2) 


Then the signer sends $” to the requester. 

Unblinding phase The requester removes the blinding fac- 
tor r from S’ and obtains the signature message S of the 
signer. 

The requester removes the blinding factor r from S” 


S = S’r-! = B’ modn (3) 


Verification phase Anyone can verify the signature S with 
the signer’s public key (e, n). 


2.2 Bit commitment 


Bit commitment was first proposed by Blum [27], which is 
a fundamental protocol in cryptography. The scheme runs 
between two untrusted called Alice and Bob, and usually 
consists of two steps, namely commitment phase and unveil- 
ing phase. 

Commitment phase Alice makes a commitment to a mes- 
sage b and then sends the commitment to Bob, and Bob 
cannot know b before Alice unveils it. 

Unveiling phase Alice proves the relation between the 
commitment and b, meantime, Alice cannot change b after 
the commitment is generated. 
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Bit commitment is used to lots of cryptographic schemes, 
such as coin tossing, zero-knowledge proofs, verifiable secret 
sharing and oblivious transfer. 


2.3 Blockchain 


The blockchain creates a digital ledger of data and shares 
it among independent miners [28]. The bitcoin plays as the 
first killer application of blockchain. In a bitcoin system, 
miners collect transactions and complete to create blocks 
whose body consists of these transactions. Once the major- 
ity of miners accept a block as the next block of blockchain 
through consensus mechanism, the transactions of this block 
cannot be altered and the corresponding miner obtains 
rewards in the form of bitcoin. The blockchain provides 
decentralized trust for each miner. Every miner maintains 
the exactly same ledger together, which ensures consistency 
from all relevant nodes in the blockchain. In the ledger, 
historical transactions are permanently created in blocks 
whose persistence is based on the persistence of the net- 
work. It is very difficult to change or delete the transactions 
of blockchain unless an attacker can compromise 51% of the 
miners in the network. Besides, all system rules are open and 
transparent and agreed by all nodes. Each miner in the net- 
work has a copy of the current digital ledger of blockchain. In 
other words, each miner holds a copy of transaction database, 
which ensures transactions cannot be operated by a single 
node alone. The blockchain includes three categories: 

Public chain Public chain lacks access control, and anyone 
has access to data of blockchain, sends data to blockchain, 
and participates in the consensus of blockchain. In other 
words, the public chain is open. 

Consortium chain Consortium chain refers to a blockchain 
managed by several organizations, which only allows the 
institutions in the system to read, write, send, and record 
transactions together. Such as hyperledger. 

Private chain Private chain is a blockchain in which 
writing permissions is concentrated in the hands of an orga- 
nization. Due to the limited and controllable participation 
nodes, the private chain can guarantee short transaction con- 
firmation latency, high throughput and privacy preservation, 
and consume almost no resources. Additionally, it is not 
attacked easily. 


2.4 Smart contract 


Smart contract is a piece of code which implements inter- 
actions between users and blockchain by creating/querying 
data on the blockchain. The smart contract translates con- 
tract in real world and integrates it into its own enforceable 
properties, which reduces the demand on trusted institutions 
among transacting parties and the occurrence of malicious 
or unexpected exceptions. 


2.5 Hyperledger 


The hyperledger [29] project is an open-source and decen- 
tralized platform. Flexibility and generality are considered as 
key concerns to support a wide variety of non-deterministic 
smart contracts (here called chaincode) and pluggable ser- 
vices. 

The chaincode is hyperledger’s smart contracts [30], 
which consists of codes deployed on the fabric network. It is 
executed and validated by the endorsing peers who maintain 
the ledger. Meanwhile, the ordering peer in the hyperledger 
creates blocks and executes ordering operation for this dis- 
tributed ledger. 


3 System model and design goals 


In this section, an improved FOO voting system using hyper- 
ledger fabric is proposed. 


3.1 System model 


The system model is illustrated in Fig. 1, and main par- 
ticipants include voters V;, certificate authority (CA) and 
chaincode (or smart contract). Their functions are described 
as follows: 

Voter A voter with identification, id;, is an entity that is 
permitted to cast a ballot only once. 

CA In the hyperledger fabric, CA issues the certification to 
voters and generates two key pairs pkm/skm, Dkc/skc for the 
management chaincode and the counting chaincode. More- 
over, in this paper, CA is not trusted and does not participate 
in the transaction process in the network after issuing the 
certificate. 

Chaincode The chaincode is divided into management 
chaincode and counting chaincode. The former’s responsi- 
bility is to automatically verify the identity information of the 
voter, sign the blind ballot information, and send the signed 
ballot to the voter. The latter’s duty is to automatically count 
ballots and publish results. 


P 
Endorser 


Committer 


(l 


Voter Management 
l = m Chaincode 
Hyperledger z 
Fabric Coama 
Voter —p] Block 4 |—p] Block 5 | oJ Block 6 


Fig.1 The blockchain-based e-voting system 
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3.2 Design goals 


The design goals include the following classes: 


(1) Eligibility Only authorized voter can vote. 

(2) Fairness The final result of voting is not influenced. 

(3) Privacy All ballots must be kept secret, and anyone 
cannot know other voters’ ballot. 

(4) Verifiability Any voter can check whether his vote has 
been correctly counted. 

(5) Uniqueness Each voter votes only once. 

(6) No receipt Each voter cannot prove to others which 
candidate he has voted for. 


4 Review and analysis of FOO voting 
protocol 


FOO voting scheme consists of three phases: voter prepara- 
tion phase, authorization phase, voting phase. The specific 
symbols are shown in Table 1. 


4.1 Voter preparation 


Step 1: Vi selects his favorite candidate v; and chooses a 
random number k; (as a key of bit commitment). Then, V; 
computes a digital commitment cv; = f(v;, ki) using bit 
commitment function f (). 

Step 2: The voter V; chooses a blinding factor r; and com- 
putes bu; = ri- H (cvi)? mod n. Then, the voter V; generates a 
signature S$; = o;(bv;) and sends (id;, bu;, S;) to the admin- 
istrator A. 


4.2 Certificate authorization 


The administrator checks the legitimacy of S;. If S; is a 
legitimate signature for bv;, the administrator A computes 
Di = (bu; )4 mod n and sends D; to V; as an authorized 
certification. 


Table 1 Important symbol table 


Symbol Meaning 

Ds Random selection of two unequal prime numbers p and q 

(e,n) public key of administrator A, which e is a random number, 
and n is a big prime. n = p * q 

d private key of administrator A 

k; a random number 

ri a blinding factor 

u,v ueR, veR 

idi The identity of the voter 
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4.3 Voting 


V; executes unblinding operation and obtains the signature 
y= (ri! Di) mod n. If the signature y; is legal for cv;, V; 
sends (x;, y;) to counting center. 


4.4 Security analysis of FOO voting protocol 


In FOO voting scheme, there are two TTPs, namely admin- 
istrator A and the counting center. Before voting, TTPs were 
established. However, in a real e-voting environment, it is 
impractical to assume the administrator A and the counting 
center are fully trusted. In addition, voters can prove their 
ballots by providing their own blind factors and the blind 
signatures provided by the administrator A. In this case, the 
voting rights could be sold and the voting system might suffer 
from coercion attack. 


5 The proposed protocol 


The scheme is divided into five different phases, namely the 
system setup phase, the registration phase, the ballot gener- 
ation phase, the voting phase and the counting phase. 


5.1 System setup phase 


The rules of elections, CA and the chaincode are determined. 
The chaincode with the function of managing and counting 
votes is deployed in the blockchain. Then, the blockchain 
builds an initialization block serving as the genesis block. The 
initialization block does not have any vote information, only 
containing other information, such as the time information 
for registration and voting, CA’s signature, authentication 
key and so on. The block structure is shown in Fig. 2. 


5.2 Registration phase 


In this phase, CA is provided with the list of legal voters and 
issues a certification to each legal voter. Moreover, CA dis- 
tributes public/private key pair to chaincode. The chaincode 
is similar to smart contract in hyperledger, which includes 


| | 


Genesis Block 
CA key 


l Jj llf 


Block 2 


Block 1 Block 3 


Time 
Candidate 1 


Candidate n 
Other parameters 


Fig.2 The initialization structure of Blockchain 
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Table 2 Voting record table 


Number Voters certification Voting mark 
Ecert, F 

2 Ecert F 

N Ecerty F 


management and counting contracts. Following steps are 
involved in this phase: 

Step 1: Vi generates a fresh public/private key pair pk; /sk; 
and sends (id;, pki) to CA. 

Step 2: CA checks the identification of V; by using the 
list of eligible voters. If V; is eligible, CA issues real-name 
certificate Ecert; for V;. 

Step 3: CA generates a signature key pair pkm/Skm based 
on RSA algorithm and publishes its public key pk, = 
(e,n),n = p x q, where p and q are secure prime num- 
bers. Then CA sends (idj, skm) to management chaincode via 
secure channel. Meanwhile, the management chaincode cre- 
ates a voting record table, as shown in Table 2. “F” indicates 
that the voter has not applied for a vote, and “T” indicates 
that the voter has applied for a vote. 

Step 4: CA generates a public/private key pair pk. /sk;, 
for the counting chaincode and sends sk, to the counting 
chaincode via a secure channel. 

Step 5: The counting chaincode generates a random num- 
ber k; and sends k; to V; 


5.3 Ballot generation phase 


The voter V; blinds the voting information and sends the blind 
information to the management chaincode as a request. Then 
the management chaincode signs the blind information and 
sends the blind signature as a response to the voter. The steps 
are given below: 

Step 1: Vi generates a ballot v; for candidates and sub- 
mits a digital commitment cv; = f (vi, ki), where f) is bit 
commitment function and k; is the key of bit commitment. 

Step 2: V; chooses a blinding factor r; and computes bu; = 
ri - H(cv;)° mod n. Then, the voter generates a signature 
Si = sigsk; (bvi, Ecert;) and sends (idi, bu;, Si, Ecert;) to 
management chaincode via a secure channel. 

Step 3: Upon receiving the message (id;, bu;, S;, Ecert;), 
the management chaincode checks if the certificate Ecert; 
and S; are valid. If yes, the management chaincode checks 
the mark in Table 2. If the mark is “F”, the management 
chaincode generates a signature Sbu; = Sigsx,,(bu;), and 
a pseudo-anonymous identifier PID; for Vi. Otherwise, it 
refuses to generate the signature and pseudo-anonymous 
identifier. 


5.4 Voting phase 


The voter V; obtains the signature of the original commit- 
ment ballot by blinding, then generates the official ballot, 
encrypts it and sends it anonymously to the counting contract. 
After receiving the message (PI D;, Sbvu;) from manage- 
ment chaincode, the voter’s operation is as follows: 

Step 1: Vi checks whether Sbv; is the legal signature of 
management chaincode to bv;. Then, V; unblinds the signed 
message Shu; = bu;/r; mod n. 

Step 2: If Sb vj isa legitimate signature of the management 
chaincode, the voter submits the official ballot information 
m;i and encrypts it with the public key pk, of the count- 
ing chaincode, where m; = ENC px, ((bvi, Sbv; )| |cu;), and 
ENC is a encryption operation. 


5.5 Counting phase 


In the counting stage, the chaincode decrypts the ballot m; 
and verifies its validity. If the ballot is legal, the count- 
ing chaincode counts the ballot to generate the final voting 
results, which are finally written into a block and this block 
is published for the consensus among miners. The process is 
as follows: 

Step 1: After receiving m;, the counting chaincode 
decrypts m; using private key sk, to obtain blind signature 
message (bv;, Shy; ) and cvi. 

Step 2: The counting chaincode reveals the commitment 
cu; using key k;, then tallies the ballots and creates a proof 
((cv;)*, (Sbu; )*), where (cu;)* = u- cvi, (Sbvi)* = v- 
Sbv; . 

Step 3: The counting chaincode sends (u, v) to V;, and 
then the message ((bv;, Sbv; )| |cv;) and counting results are 
written in the blockchain after the consensus algorithm. All 
miners should obtain the same counting result since they run 
on the same blockchain system. 


6 System analysis 


The system analysis includes the security analysis and the 
performance simulation. 


6.1 Security analysis 


The security is analyzed to satisfy the design goals, and 
shown in Table 3. 

Eligibility The CA of the consortium chain can verify the 
identity of the voter and ensure that the voters who join the 
chain are legal. Meanwhile, the protocol utilizes the charac- 
teristics of digital signature to prevent forgery. So that illegal 
entity cannot impersonate voters to be authorized by the CA. 
Therefore, the scheme can satisfy eligibility. 
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Table 3 Functionality comparisons between our scheme and related schemes 


Security requirements Fujioka’s Lin’s scheme [11] 
scheme [14] 
Eligibility Yes Yes 
Privacy No Yes 
Fairness Yes No 
Uniqueness Yes Yes 
Receipt freeness No No 
Individual verifiability Yes No 
Universal verifiability No No 
Coercion resistance No No 
TTP Yes Yes 


Nguyen’s Darwish’s Our scheme 
scheme [19] scheme [20] 

Yes Yes Yes 
Yes Yes Yes 
Yes Yes Yes 
Yes Yes Yes 
Yes Yes Yes 
Yes Yes Yes 
Yes Yes Yes 
No Yes Yes 
Yes Yes No 


Fairness The scheme provides a guarantee by using a dig- 
ital commitment that the results will not be known during 
the voting phase. In the first three stages, the voter will cre- 
ate a commitment for ballots. The commitment only will be 
opened in the counting stage. If voters are revealed before the 
counting phases, their ballots will be discarded. Therefore, 
the proposed protocol can satisfy fairness. 

Privacy The ballots m; = ENC ((bv;, Sb; )| |cvi) pke ON 
the hyperledger fabric are encrypted and only the count- 
ing chaincode can decrypt the ballots. It is difficult for the 
attacker to obtain the key pke. Therefore, the proposed pro- 
tocol can satisfy privacy. 

Anonymity If an adversary (a dishonest voter) tries to 
obtain other voting information through chaincode, the mes- 
sage ((bv;, Sbv; )||cv;) is known by all. Therefore, due to 
the timeliness and blindness of blind signature algorithms, 
the proposed protocol can satisfy anonymity. 

Public verifiability Due to the public features of the ledger, 
anyone who has the relevant rights to access the blockchain 
can verify that all the ballots are counted correctly. Each voter 
is also responsible for counting the votes, which ensures that 
their votes are included in the voting results. 

Uniqueness The requested signature Ecert; is marked as 
“T”. When the voters repeat their votes, the symbol “T” of 
Ecert; is found by the management chaincode, thus causes 
the sign of the ballot is refused by the management chaincode. 
Therefore, each voter can only obtain the signature of the 
management chaincode, so the scheme can satisfy unique- 
ness. 

No-receipt According to the proof ((cv;)*, (Sbu; )*) 
where (cv;)* = u-cv;,(Sbu; )* = v į Sbvi , we obtain 
two equations: 


((cui)*, (Shu; )*) = (u1cvi, v1 Sbvy ) (4) 
((cv;)*, (Sbu; )*) = (uzcv2, v2Sbv2 ) (5) 


When a candidate wants to buy a ballot, the voter sends id; 
and (u, v) to seller. However, the proof (u, v) can be modi- 
fied. Therefore, the seller cannot verify the authenticity of the 
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ballot. For example, If the (u1, v1) is replaced by (u2, v2), 
the second equation is also true. In other word, for the same 
ballot, the buyer cannot trust the seller, and buyers and sell- 
ers cannot reach consensus. Therefore, the proposed protocol 
can achieve no receipt. 

Collusion attack resistance Chaincode is a piece of code 
running on a blockchain with specific business logic. The user 
on the chain can review the code to judge the function of the 
chaincode. The run result of blockchain will be written and 
published, and the chaincode will strictly enforce the rules of 
the protocol. Itis computational infeasible for an adversary to 
obtain any useful knowledge with the chaincode. Therefore, 
the proposed scheme can resist the collusion attack. 

As shown in Table 3, the original FOO protocol [14] can- 
not satisfy privacy, no receipt, and universal verifiability. Lin 
et al. [11] proposed an e-voting scheme-based blind signa- 
ture. It solves the privacy problem of the voter, but cannot 
resist the attack of buying tickets in [11]. Nguyen et al. pro- 
posed scheme to satisfy privacy and receipt freeness in [19]; 
however, it cannot resist the attack of coercion resistance. 
Darwish et al. [20] proposed e-voting scheme can resist the 
attack of coercion resistance, but a TTP is introduced in [20], 
which reduces communication efficiency. In this paper, our 
scheme overcomes the weakness of other scheme and satis- 
fies the proposed design goals in Sect. 3.2. 


6.2 Performance simulation 


In order to test the performance, we define some notations as 
follows: 


Tn = Time to compute a one way hash operation. 
Te = Time to compute a RSA encryption operation 
Te = Time to compute a digital comment operation. 
Tp = Time to compute a blind signature operation. 
T; = Time to compute a RSA signature operation 
Ta = Time to compute a RSA decryption operation 
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Table 4 Comparison of computation 


Voter Registration 
institution 
Fujioka’s scheme [14] 3Te + ITs +17 + 1T 0 
Lin’s scheme [11] AT, +27, +2T, + 1Ty 27; 
Nguyen’s scheme [19] 3T, + 1T; +17, + 1T;, 1T, 
Darwish’s scheme [20] 17, + 2T, +17), 0 
Our scheme 17, + 2T, +17, + 1T. 0 


Management Counting Chaincode Sum 
organization institution 

1T; 0 - 7 
ITa + 1T, + 2T, IT - 16 
17, + 1Th 1Th - 10 
1T, + 2T, 2T; - 

- - ITa + IT; 


The performance simulation is shown in Table 4. 

As shown in Table 4, the proposed protocol has low cost of 
computing and meeting the security of the voting protocol. At 
the same time, the blockchain technique is used to remove 
trusted third parties and reduce the trust hypothesis of the 
voting model. 


7 Conclusion 


In this paper, we have proposed a voting system using 
blockchain that the voters’ privacy and voting correctness 
are guaranteed by blind signature. Meanwhile, we use smart 
contracts instead of TTP in the original FOO voting scheme 
to reduce trust assumptions in our scheme. Then, the exper- 
imental results show that our voting system has many 
functional attributes and high efficiency, and it is suitable 
for large-scale voting. 
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